MC1088729 Low
(Updated) Microsoft Defender for Office 365: Two new data tables in Advanced hunting (preview)
Summary AI-generated
Defender for Office 365 adds CampaignInfo and FileMaliciousContentInfo tables to Advanced Hunting, aiding threat investigations across email, SharePoint, OneDrive, and Teams.
Suggested actions AI-generated
- Review configuration
- Notify users
- Update documentation
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1474106 Microsoft Defender for Office 365: New MessageContents table in Advanced Hunting for Microsoft Teams messages
- MC1237728 (Updated) Advanced Hunting: new actions to block attachments and top-level URL domains
- MC1163754 Enhancements to the Deep Analysis tab of Email Entity page by Microsoft Defender for Office 365
- MC1422060 (Updated) Microsoft Defender for Office 365: Prompt injection protection for email
- MC1402307 Microsoft Defender for Cloud Apps: Improvements to threat protection capabilities
- MC1476237 Microsoft Defender for Office 365: Remediation actions from the Teams message entity flyout
Original post from Microsoft
Updated October 6, 2025: We have updated the content. Thank you for your patience.
Coming soon for Microsoft Defender for Office 365: We are excited to announce the new CampaignInfo and FileMaliciousContentInfo data tables in Advanced hunting under Email & collaboration schema.
[When this will happen:]
Public Preview: We will begin rolling out early June 2025 and expect to complete by late June 2025.
General Availability (Worldwide, GCC, GCC High, DoD): General Availability: We will begin rolling out early July 2025 and expect to complete by late November 2025, covering both Advanced Hunting and Sentinel availability.
[How this will affect your organization:]
The new tables will be available by default. SOC teams will be able to see two new data tables in Defender > Advanced hunting > Email & collaboration schema.
1. CampaignInfo
The CampaignInfo table in the Advanced hunting schema contains information about email campaigns identified by Defender for Office 365. The table will have this schema to help the security teams to investigate threats targeting their users and organization:
2. FileMaliciousContentInfo
The FileMaliciousContentInfo table in the Advanced hunting schema contains information about files that were processed by Defender for Office 365 in Microsoft SharePoint Online, Microsoft OneDrive, and Microsoft Teams. The table will have this schema to help the security teams to investigate threats targeting their users and organization:
Here are a few sample queries to get you started:
//Emails sent as part of phishing campaigns
CampaignInfo
| where Timestamp > ago(7d)
| where CampaignType has "Phish"
| project NetworkMessageId, RecipientEmailAddress, CampaignName, CampaignId, CampaignType
| join (EmailEvents | where Timestamp > ago(7d)) on NetworkMessageId, RecipientEmailAddress
| project Timestamp, NetworkMessageId, Subject, SenderMailFromAddress, RecipientEmailAddress, LatestDeliveryLocation, LatestDeliveryAction, CampaignId, CampaignName, CampaignType
//Files identified as Malware modified in last 1 day
FileMaliciousContentInfo
| where ThreatTypes == "Malware"
| where LastModifiedTime > ago(1d)
[What you need to do to prepare:]
This rollout will happen automatically by the specified dates with no admin action required before the rollout. Review your current configuration to assess the impact on your organization. You may want to notify your users about this change and update your relevant documentation.
After the Public Preview rollout, we will update this post with new documentation.
Additional details from Microsoft
- Summary
- Microsoft Defender for Office 365 will add two new Advanced hunting data tables, CampaignInfo and FileMaliciousContentInfo, rolling out from June to November 2025. These tables help security teams investigate email campaigns and malicious files across email, SharePoint, OneDrive, and Teams, with no admin action needed.